Login target url parameter limit

[Peter Schober]

* Pavel Šipoš <pavel.sipos at arnes.si> [2023-02-20 11:51]:
> We have set redirectLimit on Sessions element and its working for return url
> on logout but not on target parameter when logging in ( for example:
> /Shibboleth.sso/Login?target=https://google.com )

What exactly happens when you access an URL like that? Does the SP
actually redirect to the requested target URL?
Without an entityID present on that URL I'm guessing the SP will
forward the browser to a configured SAMLDS. If so the request could
fail at the SAMLDS[1] or would otherwise fail back at the SP once the
selected IDP is known.
-peter

[1] E.g. the SWITCHwayf software will fail with an error:
"The return URL ... could not be verified for Service Provider $SPentityID"
when configured appropriately,
cf. https://gitlab.switch.ch/aai/SWITCHwayf/-/blob/master/etc/config.dist.php#L112-119